GraphDDoS: Effective DDoS Attack Detection Using Graph Neural Networks

Li, Yuzhen; Li, Renjie; Zhou, Zhou; Jiang, Guoshun; Yang, Wei; Du, Meijie; Liu, Qingyun

doi:10.1109/cscwd54268.2022.9776097

Cited by 14 publications

(6 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Against DDoS attacks, a graph classification approach is proposed by Li et al [74]. In this work, the presented GraphDDoS model aims to detect both low-rate and high-rate DDoS attacks by considering the relationship of packets from a single flow and the relationship between flows.…”

Section: ) Network Intrusion Detection With Flow Graphsmentioning

confidence: 99%

Graph Neural Networks for Intrusion Detection: A Survey

Bilot

Madhoun

Agha³

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Cyberattacks represent an ever-growing threat that has become a real priority for most organizations. Attackers use sophisticated attack scenarios to deceive defense systems in order to access private data or cause harm. Machine Learning (ML) and Deep Learning (DL) have demonstrate impressive results for detecting cyberattacks due to their ability to learn generalizable patterns from flat data. However, flat data fail to capture the structural behavior of attacks, which is essential for effective detection. Contrarily, graph structures provide a more robust and abstract view of a system that is difficult for attackers to evade. Recently, Graph Neural Networks (GNNs) have become successful in learning useful representations from the semantic provided by graph-structured data. Intrusions have been detected for years using graphs such as network flow graphs or provenance graphs, and learning representations from these structures can help models understand the structural patterns of attacks, in addition to traditional features. In this survey, we focus on the applications of graph representation learning to the detection of network-based and hostbased intrusions, with special attention to GNN methods. For both network and host levels, we present the graph data structures that can be leveraged and we comprehensively review the state-of-the-art papers along with the used datasets. Our analysis reveals that GNNs are particularly efficient in cybersecurity, since they can learn effective representations without requiring any external domain knowledge. We also evaluate the robustness of these techniques based on adversarial attacks. Finally, we discuss the strengths and weaknesses of GNN-based intrusion detection and identify future research directions.INDEX TERMS Cyberattacks, cybersecurity, deep learning (DL), graph neural networks (GNNs), intrusion detection (IDS), machine learning (ML).

show abstract

Section: ) Network Intrusion Detection With Flow Graphsmentioning

confidence: 99%

Graph Neural Networks for Intrusion Detection: A Survey

Bilot

Madhoun

Agha³

et al. 2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…A RNN is used at node-level to encode type-specific features based on the attributes and the text content. To capture long-range relations, the authors used the Topology Adaptive Graph Convolutional Network (TAGCN) [117] GraphDDoS [86] to aggregate neighbors from different hops instead of the direct neighborhood used in traditional GCNs. All embeddings are then reduced with max-pooling and fed into a fully-connected layer for graph classification.…”

Section: Code-basedmentioning

confidence: 99%

“…Network flows also provide useful information to detect DDoS attacks. In the paper [86], GraphD-DoS aims to detect low-rate and high-rate DDoS attacks by considering the relationship between flows along with the relationship of packets from a single flow. First of all, an endpoint graph is constructed by dividing packets into two groups based on the source and destination IP addresses.…”

Section: Network Flowmentioning

confidence: 99%

A Survey on Malware Detection with Graph Representation Learning

Bilot¹,

Madhoun²,

Agha³

et al. 2023

Preprint

View full text Add to dashboard Cite

Malware detection has become a major concern due to the increasing number and complexity of malware. Traditional detection methods based on signatures and heuristics are used for malware detection, but unfortunately, they suffer from poor generalization to unknown attacks and can be easily circumvented using obfuscation techniques. In recent years, Machine Learning (ML) and notably Deep Learning (DL) achieved impressive results in malware detection by learning useful representations from data and have become a solution preferred over traditional methods. More recently, the application of such techniques on graph-structured data has achieved state-of-the-art performance in various domains and demonstrates promising results in learning more robust representations from malware. Yet, no literature review focusing on graph-based deep learning for malware detection exists. In this survey, we provide an in-depth literature review to summarize and unify existing works under the common approaches and architectures. We notably demonstrate that Graph Neural Networks (GNNs) reach competitive results in learning robust embeddings from malware represented as expressive graph structures, leading to an efficient detection by downstream classifiers. This paper also reviews adversarial attacks that are utilized to fool graph-based detection methods. Challenges and future research directions are discussed at the end of the paper. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Malware and its mitigation; • Computing methodologies → Learning latent representations; Neural networks; Spectral methods.

show abstract

“…The latter involves statistical methods [9,58] and deep learning-based ones [1,5]. Early deep learning studies model the traffic as independent sequences [18,30,42,48]. Recent popular studies rely on GCN to aggregate traffic information [15,33,70].…”

Section: Related Work 21 Network Intrusion Detection Systemmentioning

confidence: 99%

3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

Qiu

Geng

et al. 2023

Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

View full text Add to dashboard Cite

Network-based intrusion detection system (NIDS) monitors network traffic for malicious activities, forming the frontline defense against increasing attacks over information infrastructures. Although promising, our quantitative analysis shows that existing methods perform inconsistently in declaring various unknown attacks (e.g., 9% and 35% F1 respectively for two distinct unknown threats for an SVM-based method) or detecting diverse known attacks (e.g., 31% F1 for the Backdoor and 93% F1 for DDoS by a GCN-based state-of-the-art method), and reveals that the underlying cause is entangled distributions of flow features. This motivates us to propose 3D-IDS, a novel method that aims to tackle the above issues through two-step feature disentanglements and a dynamic graph diffusion scheme. Specifically, we first disentangle traffic features by a non-parameterized optimization based on mutual information, automatically differentiating tens and hundreds of complex features of various attacks. Such differentiated features will be fed into a memory model to generate representations, which are further disentangled to highlight the attack-specific features. Finally, we use a novel graph diffusion method that dynamically fuses the network topology for spatial-temporal aggregation in evolving data streams. By doing so, we can effectively identify various attacks in encrypted traffics, including unknown threats and

show abstract

GraphDDoS: Effective DDoS Attack Detection Using Graph Neural Networks

Cited by 14 publications

References 11 publications

Graph Neural Networks for Intrusion Detection: A Survey

Graph Neural Networks for Intrusion Detection: A Survey

A Survey on Malware Detection with Graph Representation Learning

3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

Contact Info

Product

Resources

About